note that password with a capital P is a class given by Bcrypt, http://bcrypt-ruby.rubyforge.org/classes/BCrypt/Password.html

if i'm reading 10 correctly it says return password if the password exists, otherwise create a new password using password hash if password hash exists (then return the result)